Beyond Vault

One organized home for API tokens, client secrets, SSH keys, service accounts, OAuth grants and MCP server details. The vault is sealed with your passphrase and kept in your browser, and it only leaves the device when you export the encrypted file yourself.

Requirements

• A current web browser

Installing

See Installing a Beyond application for what the installer does and where it puts things. Your computer checks the download for you, and that page also shows how to check it yourself if you would rather.

Features

Sealed with your passphrase

The vault is encrypted with a key made from your passphrase. Without it, the stored vault is unreadable.

It stays in your browser

The sealed vault is kept on your own device and is not sent anywhere. You move it between machines by exporting and importing an encrypted file.

Built for the keys developers hold

API tokens, client secrets, SSH keys, service accounts, OAuth grants and MCP server details, each with fields that suit it.

Rotation dates and a record

See when each secret was last rotated and when it is due, with an activity list of what was opened, copied or changed.

Reveals close themselves

A shown value hides again on its own, and the vault locks after an idle time you choose.

Known limits

• Still being built.
• One device at a time. Moving the vault is done by exporting and importing the encrypted file.

Licensing

Beyond Vault uses the standard Beyond licence: checked on your own machine, with your devices managed by you. See Licences and activation.